← Blog | Leer en espanol

OmniMon v6.7.0: Zombie Killer & AI Safety Hardening

New release

Version 6.7.0 introduces the Zombie Killer, a background engine that detects processes burning CPU or RAM for long stretches and offers them for user-confirmed termination, plus a second round of AI safety hardening (privacy mode, daily budget, frontend-confirmed automation tool calls, keyring delete-first) and a DPI transparency badge.

Zombie Killer

  • Sustained-usage detection. A new engine watches processes whose CPU or RAM stays above a threshold for a configurable window (defaults: 50% CPU sustained 1h, uptime over 7 days) and surfaces them as candidates.
  • PID-reuse safe. Every candidate is keyed by (pid, start_time), so a recycled PID never gets mistaken for a still-running zombie.
  • Panic-safe tick. The per-tick body runs under catch_unwind; a single bad process can never crash the background thread.
  • Modal with keyboard shortcut. Cmd/Ctrl+Shift+Z opens ZombieKiller.svelte, which lists candidates, lets you kill one or all, tune thresholds, and maintain a never_kill blocklist, all in EN and ES.

AI Privacy Mode

When enabled (Settings.ai_privacy_mode, default false), everything sent to the LLM goes through stable pseudonymous redaction:

  • Process names, paths, URLs, tab titles, hostnames. Replaced by 24-bit SipHash tokens so the model can still reason about identity across calls without ever seeing the raw strings.
  • Private IPs collapse to <lan>. RFC 1918, loopback, link-local, fc00::/7, fe80::/10, all flattened to a single bucket.
  • Visible controls. The toggle, a live usage counter, and the new budget input all live in a "AI Privacy & Budget" section inside Profile Settings.

Daily AI Budget

  • Per-UTC-day cap. Settings.ai_daily_limit (default 200, 0 = unlimited) complements the existing burst token bucket: burst caps rate, daily caps spend.
  • Shared across providers. The bucket spans ai_chat, analyze_processes, analyze_context, and validate_api_key.
  • Observability. New IPC get_ai_daily_usage returns (used, limit); the UI shows the counter with a refresh button.

Safer AI Tool Calls

  • Automation rules now require confirmation. add_automation_rule and remove_automation_rule no longer execute server-side inside ai_chat; they return a plan and AIChat.svelte invokes the real IPC only after the user confirms, same pattern as kill_process, kill_by_name, close_tabs, and close_connection.
  • Keyring delete-first. get_api_key_with_fallback wipes the legacy plaintext store before writing to the secure keyring. A crash mid-flight can no longer leave the API key readable on disk.
  • CSP allows local Ollama. tauri.conf.json now permits http://localhost:11434 and http://127.0.0.1:11434 without loosening the rest of the policy.

DPI Transparency Badge

A new status indicator in the StatusBar (Radar icon from lucide, aria-live="polite") appears whenever DPI telemetry is active. The tooltip makes clear OmniMon reads packet metadata only (never payload) and points to the setting that disables DPI.

Breaking: network_alerts::EvaluatorState

The alert evaluator used to hold its debounce counters and cooldown map in a process-global OnceLock<RwLock<EvaluatorState>>, which caused flaky tests when parallel threads contaminated each other's consecutive_matches map. The fix removes the global and plumbs &mut EvaluatorState through every call site:

// Before
let alerts = evaluate_network_alerts(&snap, prev, &rules, &history);

// After
let mut state = network_alerts::EvaluatorState::new();
let alerts = evaluate_network_alerts(&snap, prev, &rules, &history, &mut state);
// keep `state` alive for subsequent ticks to preserve debounce + cooldown.

In-workspace callers were updated; out-of-tree consumers must instantiate their own state or wrap both functions.

Quality

  • 458 Rust tests (288 core + 95 integration + 53 tauri + 18 + 4 tui) and 689 frontend tests with Vitest.
  • Branch coverage 70.37-70.80% (stable range), statements / functions / lines at 86%.
  • Clippy clean under Rust 1.95: ten pre-existing call sites fixed to satisfy the new unnecessary_sort_by and collapsible_match lints.

Download

macOS

Universal DMG

Windows

MSI Installer

Linux

.deb / .AppImage

Always verify downloads against SHA256SUMS.txt published in the GitHub release.

Homebrew

brew tap chochy2001/omnimon
brew install --cask omnimon
← All posts